@ai0x0/utils 0.1.2 → 0.2.0

package/es/backend/schemas/index.js

@@ -8,7 +8,9 @@ import { z } from "zod";
 import { pgTable, timestamp, uuid } from "drizzle-orm/pg-core";
 import { createInsertSchema, createSelectSchema, createUpdateSchema } from "drizzle-zod";
 
-//============================基本字段============================//
+// =============================================================================
+// 基本字段 —— 每张表都注入的那几列
+// =============================================================================
 var timestamptz = function timestamptz(name) {
   return timestamp(name, {
     withTimezone: true
@@ -67,7 +69,9 @@ export var BASIC_UPDATE_OMIT = {
   updatedAt: true
 };
 
-//============================列表查询字段============================//
+// =============================================================================
+// 列表查询字段
+// =============================================================================
 export var queryListSchema = function queryListSchema(schema) {
   return z.object({
     current: z.string().optional().default("1"),
@@ -84,7 +88,9 @@ export var queryListSchema = function queryListSchema(schema) {
   }).merge(schema);
 };
 
-//============================列表返回字段============================//
+// =============================================================================
+// 列表返回字段
+// =============================================================================
 export var listBodySchema = function listBodySchema(schema) {
   return z.object({
     total: z.number(),
@@ -92,7 +98,9 @@ export var listBodySchema = function listBodySchema(schema) {
   });
 };
 
-//============================创建一个pg表============================//
+// =============================================================================
+// 建表 —— 表 + 5 份 zod schema
+// =============================================================================
 /**
  * 基于 drizzle + drizzle-zod 快速生成带基础字段（id / 创建时间等）的
  * 表定义以及 select / insert / update / query / list zod schema。
@@ -100,10 +108,12 @@ export var listBodySchema = function listBodySchema(schema) {
 export var createTableSchema = function createTableSchema(_ref) {
   var name = _ref.name,
     columns = _ref.columns,
+    serverColumns = _ref.serverColumns,
     extraConfig = _ref.extraConfig;
-  var mergedColumns = _objectSpread(_objectSpread({}, basicFields), columns);
+  var mergedColumns = _objectSpread(_objectSpread(_objectSpread({}, basicFields), serverColumns), columns);
   var table = pgTable(name, mergedColumns, extraConfig);
   var selectSchema = createSelectSchema(table);
+  // 只从 columns 推 —— basicFields 与 serverColumns 都由服务端写，不该出现在请求体里。
   var insertSchema = createInsertSchema(pgTable(name, columns));
   var updateSchema = createUpdateSchema(pgTable(name, _objectSpread({
     id: uuid("id")

package/es/backend/sqlite/schemas/index.d.ts

@@ -119,7 +119,10 @@ export declare const listBodySchema: <T extends z.ZodType<unknown, unknown, z.co
  */
 export declare const createTableSchema: <TTableName extends string, TColumnsMap extends Record<string, SQLiteColumnBuilderBase>>(_options: {
     name: TTableName;
+    /** 客户端能写的业务列。insert / update schema 只从这里推。 */
     columns: TColumnsMap;
+    /** 由服务端盖、绝不接受客户端传的业务列（归属、租户 id 这类）。语义与 pg 版一致，见那边的说明。 */
+    serverColumns?: Record<string, SQLiteColumnBuilderBase>;
     extraConfig?: (_self: BuildExtraConfigColumns<TTableName, typeof basicFields & TColumnsMap, "sqlite">) => SQLiteTableExtraConfigValue[];
 }) => {
     table: any;

package/es/backend/sqlite/schemas/index.js

@@ -8,7 +8,9 @@ import { z } from "zod";
 import { integer, sqliteTable, text } from "drizzle-orm/sqlite-core";
 import { createInsertSchema, createSelectSchema, createUpdateSchema } from "drizzle-zod";
 
-//============================基本字段============================//
+// =============================================================================
+// 基本字段 —— 每张表都注入的那几列
+// =============================================================================
 var timestamp = function timestamp(name) {
   return integer(name, {
     mode: "timestamp_ms"
@@ -73,7 +75,9 @@ export var BASIC_UPDATE_OMIT = {
   updatedAt: true
 };
 
-//============================列表查询字段============================//
+// =============================================================================
+// 列表查询字段
+// =============================================================================
 export var queryListSchema = function queryListSchema(schema) {
   return z.object({
     current: z.string().optional().default("1"),
@@ -90,7 +94,9 @@ export var queryListSchema = function queryListSchema(schema) {
   }).merge(schema);
 };
 
-//============================列表返回字段============================//
+// =============================================================================
+// 列表返回字段
+// =============================================================================
 export var listBodySchema = function listBodySchema(schema) {
   return z.object({
     total: z.number(),
@@ -98,7 +104,9 @@ export var listBodySchema = function listBodySchema(schema) {
   });
 };
 
-//============================创建一个sqlite表============================//
+// =============================================================================
+// 建表 —— 表 + 5 份 zod schema
+// =============================================================================
 /**
  * 基于 drizzle + drizzle-zod 快速生成带基础字段（id / 创建时间等）的
  * 表定义以及 select / insert / update / query / list zod schema。
@@ -106,10 +114,12 @@ export var listBodySchema = function listBodySchema(schema) {
 export var createTableSchema = function createTableSchema(_ref) {
   var name = _ref.name,
     columns = _ref.columns,
+    serverColumns = _ref.serverColumns,
     extraConfig = _ref.extraConfig;
-  var mergedColumns = _objectSpread(_objectSpread({}, basicFields), columns);
+  var mergedColumns = _objectSpread(_objectSpread(_objectSpread({}, basicFields), serverColumns), columns);
   var table = sqliteTable(name, mergedColumns, extraConfig);
   var selectSchema = createSelectSchema(table);
+  // 只从 columns 推 —— basicFields 与 serverColumns 都由服务端写，不该出现在请求体里。
   var insertSchema = createInsertSchema(sqliteTable(name, columns));
   var updateSchema = createUpdateSchema(sqliteTable(name, _objectSpread({
     id: text("id")

package/lib/backend/route-operation/delete-operation.d.ts

@@ -1,16 +1,12 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { NextRequest } from "next/server";
 import { ZodSchema } from "zod";
 import { BaseTable } from "../types.js";
 import { type DeleteOperationOptions as CoreDeleteOperationOptions } from "./operation-core.js";
-export type DeleteOperationOptions<TTable extends BaseTable, B extends ZodSchema> = CoreDeleteOperationOptions<TTable, B>;
-export declare const createDeleteOperation: ({ db, getSession, }: {
+import type { DefaultSession, SessionGetter } from "./operation-common.js";
+export type DeleteOperationOptions<TTable extends BaseTable, B extends ZodSchema, TSession = DefaultSession> = CoreDeleteOperationOptions<TTable, B, TSession>;
+export declare const createDeleteOperation: <TSession = DefaultSession>({ db, getSession, }: {
     db?: NodePgDatabase<Record<string, unknown>> | undefined;
-    getSession(req: NextRequest): Promise<{
-        userId?: string;
-    } | undefined>;
+    getSession: SessionGetter<TSession>;
 }) => <B extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> = import("zod").ZodObject<{
     id: import("zod").ZodString;
-}, import("zod/v4/core").$strip>>({ table, schemas, access, openApiOperation, handler, catch: catchHandler, }: CoreDeleteOperationOptions<BaseTable, B, {
-    userId?: string | undefined;
-}>) => import("next-rest-framework").RouteOperationDefinition<"DELETE">;
+}, import("zod/v4/core").$strip>>({ table, schemas, access, openApiOperation, handler, catch: catchHandler, }: CoreDeleteOperationOptions<BaseTable, B, TSession>) => import("next-rest-framework").RouteOperationDefinition<"DELETE">;

package/lib/backend/route-operation/get-list-operation.d.ts

@@ -1,14 +1,10 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { NextRequest } from "next/server";
 import { ZodSchema } from "zod";
 import { BaseTable, GetListRelations } from "../types.js";
 import { type GetListOperationOptions as CoreGetListOperationOptions } from "./operation-core.js";
-export type GetListOperationOptions<T extends ZodSchema, Q extends ZodSchema, TTable extends BaseTable> = CoreGetListOperationOptions<T, Q, TTable, GetListRelations>;
-export declare const createGetListOperation: ({ db, getSession, }: {
+import type { DefaultSession, SessionGetter } from "./operation-common.js";
+export type GetListOperationOptions<T extends ZodSchema, Q extends ZodSchema, TTable extends BaseTable, TSession = DefaultSession> = CoreGetListOperationOptions<T, Q, TTable, GetListRelations, TSession>;
+export declare const createGetListOperation: <TSession = DefaultSession>({ db, getSession, }: {
     db?: NodePgDatabase<Record<string, unknown>> | undefined;
-    getSession(req: NextRequest): Promise<{
-        userId?: string;
-    } | undefined>;
-}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, jsonArrayFields, setParams, handler, catch: catchHandler, }: CoreGetListOperationOptions<T, Q, BaseTable, GetListRelations, {
-    userId?: string | undefined;
-}>) => import("next-rest-framework").RouteOperationDefinition<"GET">;
+    getSession: SessionGetter<TSession>;
+}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, jsonArrayFields, setParams, handler, catch: catchHandler, }: CoreGetListOperationOptions<T, Q, BaseTable, GetListRelations, TSession>) => import("next-rest-framework").RouteOperationDefinition<"GET">;

package/lib/backend/route-operation/get-operation.d.ts

@@ -1,14 +1,10 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { NextRequest } from "next/server";
 import { ZodSchema } from "zod";
 import { BaseTable, GetListRelations } from "../types.js";
 import { type GetOperationOptions as CoreGetOperationOptions } from "./operation-core.js";
-export type GetOperationOptions<T extends ZodSchema, Q extends ZodSchema, TTable extends BaseTable> = CoreGetOperationOptions<T, Q, TTable, GetListRelations>;
-export declare const createGetOperation: ({ getSession, db, }: {
+import type { DefaultSession, SessionGetter } from "./operation-common.js";
+export type GetOperationOptions<T extends ZodSchema, Q extends ZodSchema, TTable extends BaseTable, TSession = DefaultSession> = CoreGetOperationOptions<T, Q, TTable, GetListRelations, TSession>;
+export declare const createGetOperation: <TSession = DefaultSession>({ getSession, db, }: {
     db?: NodePgDatabase<Record<string, unknown>> | undefined;
-    getSession(req: NextRequest): Promise<{
-        userId?: string;
-    } | undefined>;
-}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, setParams, jsonArrayFields, handler, catch: catchHandler, }: CoreGetOperationOptions<T, Q, BaseTable, GetListRelations, {
-    userId?: string | undefined;
-}>) => import("next-rest-framework").RouteOperationDefinition<"GET">;
+    getSession: SessionGetter<TSession>;
+}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, setParams, jsonArrayFields, handler, catch: catchHandler, }: CoreGetOperationOptions<T, Q, BaseTable, GetListRelations, TSession>) => import("next-rest-framework").RouteOperationDefinition<"GET">;

package/lib/backend/route-operation/index.d.ts

@@ -4,3 +4,5 @@ export * from "./delete-operation.js";
 export * from "./post-operation.js";
 export * from "./put-operation.js";
 export * from "./open-api-operation.js";
+export type { AccessDenial, AccessOptions, DefaultSession, HttpMethod, SessionGetter, } from "./operation-common.js";
+export type { ScopeCondition, ScopeValue } from "../scope.js";

package/lib/backend/route-operation/operation-common.d.ts

@@ -44,6 +44,18 @@ export interface AccessOptions<TSession = DefaultSession> {
         session: TSession;
         method: HttpMethod;
     }) => boolean | AccessDenial | Promise<boolean | AccessDenial>;
+    /**
+     * 新建（POST）时额外要盖在行上的列。归属列由 `scope` 盖，这里管别的服务端字段 ——
+     * 最典型的就是「谁建的」：归属列一旦不是 `creatorId`（比如换成 `ownerId`），作者就没人写了，
+     * 而 `setBody` 只能返回请求体 schema 里有的字段，`creatorId` 不在里面。
+     *
+     * 与归属戳同一条不变量：**最后展开，客户端覆盖不了**。所以这里能安全地盖任何服务端字段，
+     * 不必担心请求体里塞一个同名键把它顶掉。
+     *
+     * 库不替业务猜要盖什么（哪张表有 creatorId、要不要记作者，都是业务的事），所以给的是钩子
+     * 而不是默认行为。
+     */
+    stamp?: (session: TSession) => Record<string, unknown>;
 }
 /**
  * 把会话读取包成「本次请求最多取一次」的取值器。

package/lib/backend/route-operation/operation-common.js

@@ -42,7 +42,7 @@ async function resolveAccess({
 }) {
   var _a;
   const wantsScope = Boolean(access == null ? void 0 : access.scope) || ((access == null ? void 0 : access.byCreator) ?? true);
-  const session = wantsScope || (access == null ? void 0 : access.can) ? await loadSession() : void 0;
+  const session = wantsScope || (access == null ? void 0 : access.can) || (access == null ? void 0 : access.stamp) ? await loadSession() : void 0;
   if (access == null ? void 0 : access.can) {
     if (!session) {
       throw new import_errors.HttpError(401, "未登录");

package/lib/backend/route-operation/post-operation.d.ts

@@ -1,14 +1,10 @@
 import { PgTable } from "drizzle-orm/pg-core";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { NextRequest } from "next/server";
 import { ZodSchema } from "zod";
 import { type PostOperationOptions as CorePostOperationOptions } from "./operation-core.js";
-export type PostOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable extends PgTable> = CorePostOperationOptions<IB, OB, TTable>;
-export declare const createPostOperation: ({ getSession, db, }: {
+import type { DefaultSession, SessionGetter } from "./operation-common.js";
+export type PostOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable extends PgTable, TSession = DefaultSession> = CorePostOperationOptions<IB, OB, TTable, TSession>;
+export declare const createPostOperation: <TSession = DefaultSession>({ getSession, db, }: {
     db?: NodePgDatabase<Record<string, unknown>> | undefined;
-    getSession(req: NextRequest): Promise<{
-        userId?: string;
-    } | undefined>;
-}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, contentType, openApiOperation, parseBody, setBody, table, handler, catch: catchHandler, }: CorePostOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>, {
-    userId?: string | undefined;
-}>) => import("next-rest-framework").RouteOperationDefinition<"POST">;
+    getSession: SessionGetter<TSession>;
+}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, contentType, openApiOperation, parseBody, setBody, table, handler, catch: catchHandler, }: CorePostOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>, TSession>) => import("next-rest-framework").RouteOperationDefinition<"POST">;

package/lib/backend/route-operation/put-operation.d.ts

@@ -1,14 +1,10 @@
 import { PgTable } from "drizzle-orm/pg-core";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { NextRequest } from "next/server";
 import { ZodSchema } from "zod";
 import { type PutOperationOptions as CorePutOperationOptions } from "./operation-core.js";
-export type PutOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable extends PgTable> = CorePutOperationOptions<IB, OB, TTable>;
-export declare const createPutOperation: ({ getSession, db, }: {
-    getSession(req: NextRequest): Promise<{
-        userId?: string;
-    } | undefined>;
+import type { DefaultSession, SessionGetter } from "./operation-common.js";
+export type PutOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable extends PgTable, TSession = DefaultSession> = CorePutOperationOptions<IB, OB, TTable, TSession>;
+export declare const createPutOperation: <TSession = DefaultSession>({ getSession, db, }: {
+    getSession: SessionGetter<TSession>;
     db?: NodePgDatabase<Record<string, unknown>> | undefined;
-}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, openApiOperation, table, setBody, handler, catch: catchHandler, }: CorePutOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>, {
-    userId?: string | undefined;
-}>) => import("next-rest-framework").RouteOperationDefinition<"PUT">;
+}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, openApiOperation, table, setBody, handler, catch: catchHandler, }: CorePutOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>, TSession>) => import("next-rest-framework").RouteOperationDefinition<"PUT">;

package/lib/backend/route-operation/write-operation-core.js

@@ -62,15 +62,22 @@ function createPostOperationFactory({
       status: 200
     }
   ]).handler(async (req) => {
+    var _a;
     try {
-      const { scope } = await (0, import_operation_common.resolveAccess)({
+      const { scope, session } = await (0, import_operation_common.resolveAccess)({
         access,
         loadSession: (0, import_operation_common.sessionLoader)(getSession, req),
         method: "POST"
       });
       const body = await (0, import_operation_common.readPostBody)(req, { contentType, parseBody });
       const extraBody = await (setBody == null ? void 0 : setBody(req)) || {};
-      const params = { ...body, ...extraBody, ...scopeStamp(scope) };
+      const stamped = session === void 0 ? {} : ((_a = access == null ? void 0 : access.stamp) == null ? void 0 : _a.call(access, session)) ?? {};
+      const params = {
+        ...body,
+        ...extraBody,
+        ...stamped,
+        ...scopeStamp(scope)
+      };
       const raw = table && db ? (await createAction({
         bodySchema: schemas.body,
         db,